@sema-agent/server 7.106.0 → 7.108.0

package/dist/outbound-dispatcher.d.ts

@@ -62,9 +62,28 @@
  * `outbound_proxy`,不进 `/health`、不进公告、不进租户 wire(代理那一跳失败的终局句只说「经代理 + 哪只变量」,F3 裁定)。代理变量不可用(undici 构造即拒:无 scheme、`ftp:`、带路径 / 查询)⇒
  * **拒启**(与 Node 24 `NODE_USE_ENV_PROXY=1` 遇坏值的行为同向)—— 静默直连 = 运维以为出网走了代理而实际没有,那是出网策略面的
  * fail-open;拒因只回显 display-safe 值。
+ *
+ * ── 建连失败的观察(S-925,7.108.0;test [ref] ② Windows 用户 VPN 中途切换)──────────────────────────────
+ * 病:建连失败(`UND_ERR_CONNECT_TIMEOUT` 一族)只有 undici 原句,不点名起服时读进的代理、不给「环境变了要重启」的出路。
+ * 观察点 = undici 的**公开诊断通道**(`undici:request:create` / `:headers` / `:error`,进程级按名订阅,npm undici 与 Node 内建那一份
+ * 同名同发):不包 handler、不动 dispatch 的热路径。{@link installOutboundDispatcher} 装一次:
+ *  ① 每条请求的建连期失败(码在闭集 {@link OUTBOUND_CONNECT_FAILURE_CODES} 里、且这条请求还没收到过响应头)⇒ 一条结构化 warn
+ *    `outbound_connect_failed { targetHost, code, proxyInUse, proxyReadAtMs, sinceBootMs, hint }`(`proxyInUse` = 这一跳走的代理**变量名**,
+ *    不打值;直连 ⇒ `null`)—— 全进程的出网都算(模型、中心、工具 …),不只模型;
+ *  ② 最近一次建连失败 + 生效代理的**名字**与读取时刻 ⇒ `GET /v1/diagnostics/wiring` 的 `outbound` 段({@link readOutboundWiring});
+ *  ③ 请求若创建在一次**模型调用**的作用域里(`model-reach-scope.ts`),结局记到那次调用上 —— 模型调用终态时由
+ *    `model-unreachable-notice.ts` 决定要不要给这条腿的用户铸 `server.model_unreachable`(只落日志不算闭环:运营用户看不到日志)。
+ * 代理 CONNECT 请求本身(`method === "CONNECT"`,打向代理的那条)不单独计 —— 它的失败会以 {@link OutboundProxyError} 的形态落在
+ * 目标请求上,那一条才知道「要去哪」。Bun 的原生 fetch 不经 undici ⇒ 通道不发、三件都没有(如实:与回环直连同一条 Bun 例外)。
  */
 import { Dispatcher } from "undici";
 import type { Logger } from "./observability/logger.js";
+/** 三只变量的读值(boot 冻结;空串 = 未设)。 */
+interface OutboundProxyEnv {
+    readonly httpProxy: string;
+    readonly httpsProxy: string;
+    readonly noProxy: string;
+}
 /**
  * 出网代理姿态(`build*`:纯数据)—— 启动日志 `outbound_proxy` 行与配置目录共读的**同一份**投影。
  *  · `httpProxy` / `httpsProxy`:http: / https: 目标**实际**走的代理(display-safe;`null` = 直连)。`httpsProxy` 在 `HTTPS_PROXY`
@@ -110,7 +129,56 @@ export declare const OUTBOUND_PROXY_INVALID_CODE = "config.outbound_proxy_invali
 export declare function createOutboundDispatcher(env?: NodeJS.ProcessEnv): {
     dispatcher: Dispatcher;
     posture: OutboundProxyPosture;
+    env: OutboundProxyEnv;
+};
+/**
+ * 建连期失败码 —— **闭集**(码 → 给运维的一句读法)。只收**只可能**在建立连接时出现的码:undici 的建连截止
+ * (`UND_ERR_CONNECT_TIMEOUT`,TCP + TLS 没在传输层的建连时限内完成)与 OS 的拒连 / 解析不了 / 无路由。可能出现在**已建立**
+ * 连接上的码(`ECONNRESET` / `ETIMEDOUT` / `UND_ERR_SOCKET`)刻意不收 —— 它们判不出「够不着」,收进来就会把一次中途断流
+ * 说成「模型不可达、去查 VPN」。加一个码 = 加一行并写明它为什么只可能在建连时出现。
+ */
+export declare const OUTBOUND_CONNECT_FAILURE_CODES: {
+    readonly UND_ERR_CONNECT_TIMEOUT: "the TCP + TLS connect did not complete within the transport's connect deadline";
+    readonly ECONNREFUSED: "the peer actively refused the connection (nothing listening there, or a firewall reset it)";
+    readonly ENOTFOUND: "the host name did not resolve";
+    readonly EAI_AGAIN: "the DNS lookup failed temporarily";
+    readonly EHOSTUNREACH: "there is no route to the host";
+    readonly ENETUNREACH: "the network is unreachable";
 };
+export type OutboundConnectFailureCode = keyof typeof OUTBOUND_CONNECT_FAILURE_CODES;
+/** 一次建连失败的事实(纯数据:日志行、诊断段、模型调用结局同一份)。`proxyInUse` = 这一跳走的代理**变量名**(不打值),直连 ⇒ `null`。 */
+export interface OutboundConnectFailure {
+    readonly targetHost: string;
+    readonly code: OutboundConnectFailureCode;
+    readonly proxyInUse: string | null;
+}
+/**
+ * 一只请求错误是不是**建连期失败**:在错误图里找第一枚闭集码;路上遇到 {@link OutboundProxyError} ⇒ 这一跳走了代理,
+ * 记下它的变量名。找不到闭集码 ⇒ `undefined`(不是建连失败:TLS、中途断、取消、超时、代理 CONNECT 非 200 …)。
+ * 纯函数、不抛(只读 `code` / `cause` / `errors` 三个自有数据位)。
+ */
+export declare function classifyOutboundConnectFailure(error: unknown): {
+    readonly code: OutboundConnectFailureCode;
+    readonly proxyInUse: string | null;
+} | undefined;
+/**
+ * `GET /v1/diagnostics/wiring` 的 `outbound` 段(`build*`:纯数据)。**名不打值**:代理只报是哪只变量供的(`HTTP_PROXY` / `HTTPS_PROXY`;
+ * https 目标在 `HTTPS_PROXY` 缺席时回落 `HTTP_PROXY`,undici 的读法),`NO_PROXY` 只报在不在场;代理地址一个字节都不上本段
+ * (地址在启动日志 `outbound_proxy` 行,display-safe)。未安装(不是由 main.ts / run-local 装起来的进程)⇒ `null`。
+ */
+export interface OutboundWiring {
+    readonly proxy: {
+        readonly http: "HTTP_PROXY" | null;
+        readonly https: "HTTPS_PROXY" | "HTTP_PROXY" | null;
+    };
+    readonly noProxy: boolean;
+    readonly loopbackDirect: boolean;
+    readonly proxyReadAtMs: number;
+    readonly lastConnectFailure: (OutboundConnectFailure & {
+        readonly atMs: number;
+    }) | null;
+}
+export declare function readOutboundWiring(): OutboundWiring | null;
 /** 安装结果 = 姿态 + 这条规则在本进程**是否生效**(运行时的 fetch 读不读 undici 全局槽 —— Node 读、Bun 不读)。 */
 export interface OutboundDispatcherInstall extends OutboundProxyPosture {
     readonly loopbackDirect: boolean;
@@ -122,4 +190,5 @@ export interface OutboundDispatcherInstall extends OutboundProxyPosture {
 export declare function installOutboundDispatcher(logger: Logger, env?: NodeJS.ProcessEnv): OutboundDispatcherInstall;
 /** 测试专用:撤回安装(槽还给装之前的那只,本只关掉),下一次 {@link installOutboundDispatcher} 重新读 env。 */
 export declare function resetOutboundDispatcherForTest(): void;
+export {};
 //# sourceMappingURL=outbound-dispatcher.d.ts.map

package/dist/outbound-dispatcher.js

@@ -1,6 +1,9 @@
 import { Agent, Dispatcher, EnvHttpProxyAgent, getGlobalDispatcher, Pool, setGlobalDispatcher } from "undici";
 import { isIP } from "node:net";
+import diagnosticsChannel from "node:diagnostics_channel";
 import { buildDisplaySafeUrl, DISPLAY_SAFE_URL_TOKEN } from "./trace/redact.js";
+import { recordFailOpen } from "./observability/fail-open.js";
+import { currentModelCallReach } from "./model-reach-scope.js";
 function readOutboundProxyEnv(env = process.env) {
     return {
         httpProxy: env.http_proxy ?? env.HTTP_PROXY ?? "",
@@ -173,7 +176,120 @@ export function createOutboundDispatcher(env = process.env) {
     catch (err) {
         throw refuse(err instanceof Error && "code" in err && typeof err.code === "string" ? err.code : "invalid");
     }
-    return { dispatcher: new OutboundDispatcher(new Agent(), proxied), posture: postureOf(v) };
+    return { dispatcher: new OutboundDispatcher(new Agent(), proxied), posture: postureOf(v), env: v };
+}
+export const OUTBOUND_CONNECT_FAILURE_CODES = {
+    UND_ERR_CONNECT_TIMEOUT: "the TCP + TLS connect did not complete within the transport's connect deadline",
+    ECONNREFUSED: "the peer actively refused the connection (nothing listening there, or a firewall reset it)",
+    ENOTFOUND: "the host name did not resolve",
+    EAI_AGAIN: "the DNS lookup failed temporarily",
+    EHOSTUNREACH: "there is no route to the host",
+    ENETUNREACH: "the network is unreachable",
+};
+const isConnectFailureCode = (c) => typeof c === "string" && Object.hasOwn(OUTBOUND_CONNECT_FAILURE_CODES, c);
+const CONNECT_ERROR_GRAPH_BUDGET = 16;
+export function classifyOutboundConnectFailure(error) {
+    const queue = [error];
+    let proxyInUse = null;
+    for (let seen = 0; queue.length > 0 && seen < CONNECT_ERROR_GRAPH_BUDGET; seen++) {
+        const node = queue.shift();
+        if (typeof node !== "object" || node === null)
+            continue;
+        if (node instanceof OutboundProxyError)
+            proxyInUse = node.from;
+        const code = Object.getOwnPropertyDescriptor(node, "code")?.value;
+        if (isConnectFailureCode(code))
+            return { code, proxyInUse };
+        const cause = Object.getOwnPropertyDescriptor(node, "cause")?.value;
+        if (cause !== undefined)
+            queue.push(cause);
+        const errors = Object.getOwnPropertyDescriptor(node, "errors")?.value;
+        if (Array.isArray(errors))
+            queue.push(...errors.slice(0, CONNECT_ERROR_GRAPH_BUDGET));
+    }
+    return undefined;
+}
+function targetHostOf(origin) {
+    const text = typeof origin === "string" ? origin : origin instanceof URL ? origin.href : "";
+    return URL.canParse(text) ? new URL(text).host : "(unreadable origin)";
+}
+let observer;
+const requestCalls = new WeakMap();
+const answeredRequests = new WeakSet();
+const requestOf = (message) => {
+    const r = typeof message === "object" && message !== null ? Reflect.get(message, "request") : undefined;
+    return typeof r === "object" && r !== null ? r : undefined;
+};
+function startConnectObserver(logger, nowMs) {
+    const subs = [];
+    const current = {
+        proxyReadAtMs: nowMs,
+        unsubscribe: () => {
+            for (const [name, fn] of subs)
+                diagnosticsChannel.unsubscribe(name, fn);
+        },
+    };
+    const guard = (site, fn) => (message) => {
+        try {
+            fn(message);
+        }
+        catch (e) {
+            recordFailOpen("server.outbound.connect-observer-threw", `site=${site} err=${e instanceof Error ? e.name : typeof e}`);
+        }
+    };
+    const onCreate = guard("create", (message) => {
+        const request = requestOf(message);
+        const call = currentModelCallReach();
+        if (request !== undefined && call !== undefined)
+            requestCalls.set(request, call);
+    });
+    const onHeaders = guard("headers", (message) => {
+        const request = requestOf(message);
+        if (request === undefined)
+            return;
+        answeredRequests.add(request);
+        const call = requestCalls.get(request);
+        if (call !== undefined)
+            call.last = { kind: "reached" };
+    });
+    const onError = guard("error", (message) => {
+        const request = requestOf(message);
+        if (request === undefined || Reflect.get(request, "method") === "CONNECT")
+            return;
+        const call = requestCalls.get(request);
+        const verdict = answeredRequests.has(request) ? undefined : classifyOutboundConnectFailure(Reflect.get(message, "error"));
+        if (verdict === undefined) {
+            if (call !== undefined)
+                call.last = { kind: "other" };
+            return;
+        }
+        const failure = { targetHost: targetHostOf(Reflect.get(request, "origin")), ...verdict };
+        current.last = { ...failure, atMs: Date.now() };
+        logger.warn("outbound_connect_failed", {
+            ...failure,
+            proxyReadAtMs: current.proxyReadAtMs,
+            sinceBootMs: Math.round(process.uptime() * 1000),
+            hint: `${OUTBOUND_CONNECT_FAILURE_CODES[failure.code]} — ${failure.proxyInUse !== null ? `this hop went through the proxy from ${failure.proxyInUse} (read once at boot)` : "this hop was a direct connection"}; if the VPN / proxy changed since boot, restart the server so it re-reads HTTP(S)_PROXY / NO_PROXY`,
+        });
+        if (call !== undefined)
+            call.last = { kind: "connect_failed", failure };
+    });
+    subs.push(["undici:request:create", onCreate], ["undici:request:headers", onHeaders], ["undici:request:error", onError]);
+    for (const [name, fn] of subs)
+        diagnosticsChannel.subscribe(name, fn);
+    return current;
+}
+export function readOutboundWiring() {
+    if (installed === undefined || observer === undefined)
+        return null;
+    const v = installed.env;
+    return {
+        proxy: { http: v.httpProxy !== "" ? "HTTP_PROXY" : null, https: v.httpsProxy !== "" ? "HTTPS_PROXY" : v.httpProxy !== "" ? "HTTP_PROXY" : null },
+        noProxy: postureOf(v).noProxy !== null,
+        loopbackDirect: installed.result.loopbackDirect,
+        proxyReadAtMs: observer.proxyReadAtMs,
+        lastConnectFailure: observer.last ?? null,
+    };
 }
 const GLOBAL_DISPATCHER_SLOTS = [Symbol.for("undici.globalDispatcher.1"), Symbol.for("undici.globalDispatcher.2")];
 let installed;
@@ -181,7 +297,7 @@ export function installOutboundDispatcher(logger, env = process.env) {
     if (installed !== undefined)
         return installed.result;
     const prior = getGlobalDispatcher();
-    const { dispatcher, posture } = createOutboundDispatcher(env);
+    const { dispatcher, posture, env: proxyEnv } = createOutboundDispatcher(env);
     setGlobalDispatcher(dispatcher);
     const loopbackDirect = GLOBAL_DISPATCHER_SLOTS.every((slot) => Reflect.get(globalThis, slot) === dispatcher);
     const result = { ...posture, loopbackDirect };
@@ -196,10 +312,14 @@ export function installOutboundDispatcher(logger, env = process.env) {
     else {
         logger.info("outbound_proxy", { ...result, runtime });
     }
-    installed = { dispatcher, prior, result };
+    installed = { dispatcher, prior, result, env: proxyEnv };
+    observer?.unsubscribe();
+    observer = startConnectObserver(logger, Date.now());
     return result;
 }
 export function resetOutboundDispatcherForTest() {
+    observer?.unsubscribe();
+    observer = undefined;
     if (installed === undefined)
         return;
     const { dispatcher, prior } = installed;

package/dist/plugins/park-commit-watch.d.ts

@@ -0,0 +1,48 @@
+/**
+ * 🔴 **S-929 F1(7.108.0 [ref] 合并复审 codex 腿 A ①,[high] 回归修)—— park 提交的唯一观察点。**
+ *
+ * core 的 durable park 就是对本仓 checkpoint 店的一次 `put`(SQL 孪生 / 本地文件店都是本仓的 `CheckpointStore` 实现,
+ * 一只实例、四个消费点 —— 见 `boot/stage-06-runners.ts` 的构造注)。审批协调器交出 park 路由(ask 回调返回 `"unavailable"`)
+ * **之后** core 才铸行、才 `put`;两者之间隔着 core 自己的 park 前置(会话叶、环境快照…)。所以「ask 回调返回」**不是**
+ * 「park 落盘」,有序关停若把前者当后者,就会在 `put` 之下关掉连接池(修前病:park 行没提交,审计账本却已记「结清」)。
+ *
+ * 本模块给店加**一层**装饰(两店同用,不读 core 私有键 —— [ref]):
+ *  ① **计在飞 `put`**:`quiesce(deadlineMs)` 等到零或到期(绝对时刻,`Date.now()` 域),如实返回残余数 —— 收尾链在
+ *     `backend.close()` 之前等它(`boot/shutdown.ts`),审批协调器的关停收尾也等它(`ToolApprovalCoordinator.drainForShutdown`);
+ *  ② **报 park 提交** —— 「这只店里有了这一行」的两种观察,同一件事实:一次 `put` 落定(resolve);或一次 `put` 抛错之后,同一 token 的
+ *     `get` 读到了行(写已落、回执丢了 —— core 的挂起序正是用这一次回读确认提交的,本层观察的就是那一次读,不另读;车内 codex r1)。
+ *     那一行是审批停车行(`pendingAction.kind === "tool_approval"`,kind 先判 —— core d.ts「Every consumer that reads the tool fields MUST
+ *     branch on `kind` first」)⇒ 把**停车行自己陈述的**调用身份交给订阅者({@link CommittedParkCalls})。抛错且回读不到 = 没提交,不报。
+ *     身份取自**读到的那一行**(不是本进程想写的那一只):哪怕 token 撞了别人的行,报出去的也只是那一行真握着的调用。
+ *
+ * 订阅者契约:**不得抛**。订阅者跑在 `put` 已提交之后、返回给 core 之前 —— 一只抛错的订阅者会把一次**已提交**的 park 报成失败。
+ * 唯一的订阅者是审批协调器(写审计 settle 行,那只 sink 自吞失败并按 [ref] 留痕),它在自己那一侧兜住(同 tag 扩射程,见协调器)。
+ */
+import type { CheckpointStore } from "@sema-agent/core";
+/**
+ * 一只**已提交**的审批停车行说它握着哪些调用(停车行自己的陈述,原样,不是推断):
+ *  · `sessionId` —— 行停住的会话 `cp.sessionId`(执行这次调用的会话:委派 / 后台子代的行落在**子会话**上)。core 铸行用的是 prepare-task 的
+ *    同一个 `sessionId`,它也是同一次调用的 ask 上的 `sourceTaskId`(`askSourceIdentity`)⇒ 订阅者按**相等**配,不做别名(车 SO:
+ *    调用 id 只在 run 内唯一,宿主会话若当子代的等价别名,宿主停车行会冒充子代的提交);
+ *  · `toolCallIds` —— 停在门前的那只调用(`pendingAction.toolCallId`)∪ 同一条助手消息里**尚未执行**的调用
+ *    (`batchToolCallIds − completedCallIds`,core d.ts「#k+1..N are still pending」):那些调用随这一行一起被持久挂起,
+ *    续跑时重新过门 —— 它们的等待同样由这一行承载。
+ */
+export interface CommittedParkCalls {
+    readonly sessionId: string;
+    readonly toolCallIds: readonly string[];
+}
+/** 装饰层的观察面(`create*` 产出的活对象的一半;另一半是装饰后的店本身)。 */
+export interface ParkCommitWatch {
+    /** 订阅 park 提交(见模块头「订阅者契约」:不得抛)。 */
+    onParkCommitted(listener: (calls: CommittedParkCalls) => void): void;
+    /** 等在飞 `put` 归零或到 `deadlineMs`(绝对时刻,`Date.now()` 域);返回那一刻的残余在飞数(0 = 静默了)。从不抛。 */
+    quiesce(deadlineMs: number): Promise<{
+        inFlight: number;
+    }>;
+}
+export declare function createParkCommitWatch<S extends Pick<CheckpointStore, "put" | "get">>(inner: S): {
+    store: S;
+    watch: ParkCommitWatch;
+};
+//# sourceMappingURL=park-commit-watch.d.ts.map

package/dist/plugins/park-commit-watch.js

@@ -0,0 +1,87 @@
+function committedParkCallsOf(cp) {
+    const pa = cp.pendingAction;
+    if (pa.kind !== "tool_approval")
+        return undefined;
+    const completed = new Set(pa.completedCallIds);
+    const toolCallIds = [pa.toolCallId, ...pa.batchToolCallIds.filter((id) => id !== pa.toolCallId && !completed.has(id))];
+    return { sessionId: cp.sessionId, toolCallIds };
+}
+const UNCONFIRMED_PUT_TOKENS_MAX = 256;
+export function createParkCommitWatch(inner) {
+    const listeners = [];
+    let inFlight = 0;
+    const idleWaiters = new Set();
+    const unconfirmed = new Set();
+    const notify = (row) => {
+        const calls = committedParkCallsOf(row);
+        if (calls !== undefined)
+            for (const l of listeners)
+                l(calls);
+    };
+    const put = async (token, cp) => {
+        inFlight += 1;
+        try {
+            try {
+                await inner.put(token, cp);
+            }
+            catch (err) {
+                unconfirmed.add(token);
+                if (unconfirmed.size > UNCONFIRMED_PUT_TOKENS_MAX) {
+                    const oldest = unconfirmed.values().next();
+                    if (oldest.done !== true)
+                        unconfirmed.delete(oldest.value);
+                }
+                throw err;
+            }
+            notify(cp);
+        }
+        finally {
+            inFlight -= 1;
+            if (inFlight === 0)
+                for (const wake of [...idleWaiters])
+                    wake();
+        }
+    };
+    const get = async (token) => {
+        if (!unconfirmed.has(token))
+            return inner.get(token);
+        unconfirmed.delete(token);
+        const row = await inner.get(token);
+        if (row !== null)
+            notify(row);
+        return row;
+    };
+    const store = new Proxy(inner, {
+        get(target, prop) {
+            if (prop === "put")
+                return put;
+            if (prop === "get")
+                return get;
+            const v = Reflect.get(target, prop, target);
+            return typeof v === "function" ? v.bind(target) : v;
+        },
+    });
+    const watch = {
+        onParkCommitted(listener) {
+            listeners.push(listener);
+        },
+        quiesce(deadlineMs) {
+            if (inFlight === 0 || Date.now() >= deadlineMs)
+                return Promise.resolve({ inFlight });
+            return new Promise((resolve) => {
+                const timer = setTimeout(() => {
+                    idleWaiters.delete(wake);
+                    resolve({ inFlight });
+                }, deadlineMs - Date.now());
+                const wake = () => {
+                    clearTimeout(timer);
+                    idleWaiters.delete(wake);
+                    resolve({ inFlight: 0 });
+                };
+                idleWaiters.add(wake);
+            });
+        },
+    };
+    return { store, watch };
+}
+//# sourceMappingURL=park-commit-watch.js.map

package/dist/router/route-orchestration.js

@@ -1,5 +1,6 @@
 import { COARSE_SHELL_TOOLS } from "@sema-agent/core";
 import { operatorAlwaysHumanAsk } from "../operator-ask.js";
+import { heldRuleName } from "../tool-rule-names.js";
 export function routeOrchestration(s) {
     if (s.explicitMode)
         return { mode: s.explicitMode, reason: `explicit:${s.explicitMode}` };
@@ -42,9 +43,13 @@ export function isIsolatedExecEnv(provider, runtimeClass) {
 const WRITE_HAND_TOOLS = new Set(["Edit", "Write", "NotebookEdit"]);
 const SHELL_TOOLS = new Set(COARSE_SHELL_TOOLS);
 export function supPostureOverrides() {
-    const ask = (toolName) => operatorAlwaysHumanAsk(`supervisor routing(capability-danger:${toolName})`, `${toolName} gated by supervisor routing (capability-danger task)`);
     const gate = {
-        check: (req) => (WRITE_HAND_TOOLS.has(req.toolName) || SHELL_TOOLS.has(req.toolName) ? ask(req.toolName) : { action: "allow" }),
+        check: (req) => {
+            const hit = heldRuleName(req, (n) => WRITE_HAND_TOOLS.has(n) || SHELL_TOOLS.has(n));
+            return hit !== undefined
+                ? operatorAlwaysHumanAsk(`supervisor routing(capability-danger:${hit})`, `${req.toolName} gated by supervisor routing (capability-danger task)`)
+                : { action: "allow" };
+        },
     };
     return { shellGate: "always", toolPolicy: gate };
 }

package/dist/runs.js

@@ -5,6 +5,7 @@ import { TOOL_DECLARATION_HTTP_STATUS } from "./tool-declaration-http-status.js"
 import { isSessionErrorCode, sessionErrorHttp } from "./session-error-wire.js";
 import { redactErrorMessage } from "./observability/run-terminal.js";
 import { withPrincipal } from "./observability/principal-context.js";
+import { withModelReachScope } from "./model-reach-scope.js";
 import { redactSecrets } from "./trace/redact.js";
 import { taskNotificationEventData, appendModelUsageDelta, appendPromptManifest, attachModelUsage } from "./trace/project.js";
 import { createLedgerSink } from "./trace/ledger-sink.js";
@@ -419,7 +420,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
                 await append("suggestions", { suggestions: suggestions.map((s) => redactSecrets(s)) });
             }
         };
-        await withPrincipal(principal, () => {
+        await withModelReachScope(spec.sessionId, () => withPrincipal(principal, () => {
             const withElicit = elicitation
                 ? () => elicitation.runWithContext({ taskId, owner: elicitOwner ?? owner, emit: elicitEmit, abortSignal: cancelCtrl.signal }, runBody)
                 : runBody;
@@ -442,7 +443,7 @@ export async function runInBackground(runner, spec, runStore, taskId, metrics, p
             return sendUserFile
                 ? sendUserFile.runWithContext({ taskId, emit: (frame) => { const { type, ...rest } = frame; return append(type, rest); } }, withApproval)
                 : withApproval();
-        });
+        }));
         if (!reached && cancelCtrl.signal.aborted) {
             try {
                 await flush();

package/dist/runtime-governance.js

@@ -2,6 +2,7 @@ import { combinePolicies, COARSE_SHELL_TOOLS as CORE_COARSE_SHELL_TOOLS, createC
 import { GovernanceConfig } from "@sema-agent/settings-schema";
 import { currentGovernanceAskMarks } from "./governance-ask-marks.js";
 import { operatorAsk, withDeploymentAuthorship } from "./operator-ask.js";
+import { heldRuleName } from "./tool-rule-names.js";
 const COMMAND_RULE_SHAPE = GovernanceConfig.shape.commandPolicy.unwrap().element.shape;
 const COMMAND_DECISIONS = COMMAND_RULE_SHAPE.decision.options;
 export const AUTONOMY_MODES = GovernanceConfig.shape.autonomy.unwrap().options;
@@ -20,7 +21,7 @@ function createCommandAskListPolicy(askCommands, tools = COARSE_SHELL_TOOLS) {
     const ask = (message, rule) => operatorAsk(rule, message);
     return {
         check(req) {
-            if (!shellTools.has(req.toolName))
+            if (heldRuleName(req, (n) => shellTools.has(n)) === undefined)
                 return { action: "allow" };
             const command = req.args?.command;
             if (typeof command !== "string")
@@ -135,7 +136,7 @@ function createGovernanceShellGateMarkPolicy(marksOf, tools = COARSE_SHELL_TOOLS
     const shellTools = new Set(tools);
     return {
         check(req) {
-            if (shellTools.has(req.toolName))
+            if (heldRuleName(req, (n) => shellTools.has(n)) !== undefined)
                 marksOf()?.setMarked(req.toolCallId, true);
             return { action: "allow" };
         },

package/dist/task-settings.d.ts

@@ -35,25 +35,38 @@
  *  - (`hooks` NO LONGER deferred either — 轴B #2 注释保鲜:applied 形已接线(本文件 hooks 分片 +
  *    main.ts 单用户闸),仅 malformed 才报 deferred;旧「需要 remote hook-runner」是接线前拍照。)
  */
-import { type ExecutionEnv, type TaskSpec, type ThinkingLevel, type ToolPolicy, type PromptProvider } from "@sema-agent/core";
+import { type ExecutionEnv, type TaskSpec, type ThinkingLevel, type ToolPolicy, type PromptProvider, type PermissionMode } from "@sema-agent/core";
 import type { HooksConfig } from "@sema-agent/settings-schema/hooks";
 import { type KeyClosureIssue } from "./request-key-closure.js";
-/** The permission MODE a client may request (SDK `SettingsPermissions.defaultMode`), the [ref]/[ref] five-word
- *  table. ⚠️ This is a DELIBERATE deployment set, NOT a copy of any CC set ([ref] P2-1 corpus check): CC's own
- *  full enum is SIX words (= ours + `dontAsk`), CC's managed/remote form accepts FOUR (= ours − `bypassPermissions`,
- *  which it warns-and-ignores). Ours = {CC-remote four} ∪ {`bypassPermissions`} — registered divergence, not parity.
- *  `bypassPermissions` and `auto` joined the set with the [ref] fs-write gate: since the gate exists, every
- *  mode is a choice of HOW MUCH mode-derived gating the interpretation layer ADDS on top of the deployment baseline —
- *  `bypassPermissions` adds none (= the pre-[ref] behavior of every mode: "不加门" not "开门", [ref] table row 4; the
- *  deployment approval/governance baseline is composed OUTSIDE this derive and is untouchable from a settings stamp),
- *  and `auto` adds the same ask gate as `default` with core's auto-mode classifier screening the asks upstream
- *  (entitlement-gated in core, [ref]②). */
-export declare const SETTINGS_PERMISSION_MODES: readonly ["default", "acceptEdits", "plan", "bypassPermissions", "auto"];
-/** 五模式闭集的型形 —— **从值表派生**(S-496 / [ref]):改前本仓有 **4 份**同一张五词表(本处的手写联合 /
- *  下面 `coercePermissionModeStrict` 的运行期字面量链 / `http/admission.ts` 顶层 `permissionMode` 的比较链 /
- *  同文件 `settings.permissions.defaultMode` 的比较链),外加两句错误文案里各抄一遍词。现在值表一份、
- *  型与文案都从它派生,比较链改调 {@link isSettingsPermissionMode}。 */
-export type SettingsPermissionMode = (typeof SETTINGS_PERMISSION_MODES)[number];
+/**
+ * S-902(7.107.0,车QY 候裁 11 裁 A;[ref])—— core 的**每一个**权限模式词,本仓请求面收不收:`"request"` = 受理(顶层 `permissionMode` /
+ * `settings.permissions.defaultMode` / `?permissionMode=` 查询串三处同读),`"excluded"` = 显式排除(不上请求面)。
+ *
+ * 🔴 这张表是**表态**,不是词表的第二份:词与词序只从 core `PERMISSION_MODES` 来(下面 {@link SETTINGS_PERMISSION_MODES} 按它过滤);
+ * 表只对每个词说一句「收 / 不收」。`satisfies Record<PermissionMode, …>` 对 core 的词型**穷举**:core 加一个词 ⇒ 本表缺键 **编译红**
+ * (新词必须被表态一次,不会被静默收进请求面、也不会被静默漏掉);core 删 / 改名一个词 ⇒ 本表多键编译红(残条目不留)。
+ *
+ * 今天的表态(与 7.106.0 逐字同行为):五词受理;`dontAsk`(CC 的「自动拒」档,core 7.34.0 起第六词)**排除** —— 它上不上请求面是一件
+ * 新能力(未裁,本表不替它裁);不收它时提交面 400 `request.field_invalid`,续跑重放腿按 {@link coercePermissionMode} 的既有宽读折 `default`。
+ * 语义沿革(为什么是这五个、`bypassPermissions` / `auto` 何时进来):[ref] / [ref] / [ref] —— CC 自己的全集是六词,CC 托管 / 远端形收四词
+ * (= 本仓 − `bypassPermissions`),本仓 = {CC 远端四词} ∪ {`bypassPermissions`},登记过的偏离;生效模式原样过境 `TaskSpec.permissionMode`(S-877)。
+ */
+export declare const PERMISSION_MODE_REQUEST_FACE: {
+    readonly default: "request";
+    readonly acceptEdits: "request";
+    readonly plan: "request";
+    readonly auto: "request";
+    readonly bypassPermissions: "request";
+    readonly dontAsk: "excluded";
+};
+/** 请求面受理的模式词的型形 —— 从表态表派生(`"request"` 那几行的键)。 */
+export type SettingsPermissionMode = {
+    [M in PermissionMode]: (typeof PERMISSION_MODE_REQUEST_FACE)[M] extends "request" ? M : never;
+}[PermissionMode];
+/** 请求面受理的模式词(core 序)= core `PERMISSION_MODES` 过滤表态 `"request"`。wire 门、coerce 两族、两句 400 文案同读这一份。 */
+export declare const SETTINGS_PERMISSION_MODES: readonly SettingsPermissionMode[];
+/** 显式排除集(core 序)= core `PERMISSION_MODES` 过滤表态 `"excluded"`;今天恰是 `["dontAsk"]`。只作披露 / 钉读,不参与判定。 */
+export declare const SETTINGS_PERMISSION_MODES_EXCLUDED: readonly Exclude<PermissionMode, SettingsPermissionMode>[];
 /** 五词表的 wire 文案形(`"a" | "b" | …`)—— 两条 400 的句子从这里取词,不再各抄一份。 */
 export declare const SETTINGS_PERMISSION_MODE_WORDS: string;
 /** 闭集成员判定(`unknown` 入口用)—— 词表的**唯一**运行期读者:wire 门与 coerce 两族同调。 */

package/dist/task-settings.js

@@ -1,9 +1,19 @@
-import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, createPermissionRulePolicy, parseRuleText, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, ruleToolGrammarOf, } from "@sema-agent/core";
+import { combinePolicies, createAllowDenyPolicy, createFsWriteGatePolicy, createPermissionRulePolicy, parseRuleText, tightenTaskSpec, resolveReasoningProfile, rankOf, isThinkingLevel, CYBER_RISK, URL_SAFETY, HARNESS_SECTION_ANCHOR, RUN_WORKFLOW_TOOL_NAME, PERMISSION_MODES, ruleToolGrammarOf, } from "@sema-agent/core";
 import { findUnmatchableToolNames, formatUnmatchableToolNames } from "./config.js";
 import { CONTROL_AND_BIDI_STRIP_RE } from "./text-bidi.js";
 import { MAX_KEY_ECHO, keyClosureClause, scanKeyClosure } from "./request-key-closure.js";
 import { parseHooksConfig } from "./hooks/hook-runner.js";
-export const SETTINGS_PERMISSION_MODES = ["default", "acceptEdits", "plan", "bypassPermissions", "auto"];
+import { heldRuleName } from "./tool-rule-names.js";
+export const PERMISSION_MODE_REQUEST_FACE = {
+    default: "request",
+    acceptEdits: "request",
+    plan: "request",
+    auto: "request",
+    bypassPermissions: "request",
+    dontAsk: "excluded",
+};
+export const SETTINGS_PERMISSION_MODES = PERMISSION_MODES.filter((m) => PERMISSION_MODE_REQUEST_FACE[m] === "request");
+export const SETTINGS_PERMISSION_MODES_EXCLUDED = PERMISSION_MODES.filter((m) => PERMISSION_MODE_REQUEST_FACE[m] === "excluded");
 export const SETTINGS_PERMISSION_MODE_WORDS = SETTINGS_PERMISSION_MODES.map((m) => `"${m}"`).join(" | ");
 export function isSettingsPermissionMode(raw) {
     return typeof raw === "string" && SETTINGS_PERMISSION_MODES.includes(raw);
@@ -269,10 +279,11 @@ function createRuleListPolicy(names, behavior, pathBases) {
     }
 }
 const WORKFLOW_ASK_NAMES = [RUN_WORKFLOW_TOOL_NAME];
+const isWorkflowName = (name) => name === RUN_WORKFLOW_TOOL_NAME;
 function createWorkflowAskPolicy(isExempt) {
     return {
         async check(req) {
-            if (req.toolName !== RUN_WORKFLOW_TOOL_NAME)
+            if (heldRuleName(req, isWorkflowName) === undefined)
                 return { action: "allow" };
             if (isExempt) {
                 try {
@@ -290,7 +301,7 @@ function createWorkflowAskPolicy(isExempt) {
 function createWorkflowPlanDenyPolicy() {
     return {
         check(req) {
-            return req.toolName === RUN_WORKFLOW_TOOL_NAME
+            return heldRuleName(req, isWorkflowName) !== undefined
                 ? { action: "deny", message: `Plan mode is active — "${req.toolName}" is a write/mutating tool and is read-only-blocked.`, decisionReason: "rule" }
                 : { action: "allow" };
         },